IN THE CLAIMS 

Please cancel claims 1-20 without prejudice or disclaimer, and add new claims ll-ll. 
All pending claims and their present status are produced below. 

1-20. (Cancelled) 

2 1 , (Original) A method for correlating request packets and reply packets during network 
analysis, comprising: 

(a) reading a packet from a capture file; 

(b) identifying a key associated with at least one layer of the packet that resides above 
a data link control layer; 

(c) determining whether the packet is a request packet or a reply packet; 

(d) if the packet includes a request packet: 

(i) storing data associated with the request packet in a hash table utilizing the 
key as an index into the hash table, and 

(ii) decoding the request packet; 

(e) if the packet includes a reply packet; 

(i) determining whether the reply packet includes the key, 

(ii) if the reply packet includes the key, retrieving the data associated with the 
request packet from the hash table utilizing the key, 

(iii) correlating the reply packet with the request packet associated with the 
data, and 

(iv) decoding the reply packet; 

(f) determining whether another packet exists in the capture file; and 

(g) repeating (a)-(f) if it is determined that another packet exists in the capture file. 
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22. (New) A computer-implemented method for correlating request packets and reply 
packets during network analysis, comprising: 

(a) identifying a key associated with at least one layer of a packet that resides above a 
data link control layer; 

(b) responsive to the packet including a request packet: 

(i) storing data associated with the request packet utiUzing the key as an 
index corresponding to the stored data, and 

(ii) decoding the request packet; and 

(c) responsive to the packet including a reply packet: 

(i) if the reply packet includes the key, retrieving the data associated with the 
request packet utilizing the key as the index corresponding to the data, 

(ii) correlating the reply packet with the request packet associated with the 
data, and 

(iii) decoding the reply packet using at least in part the retrieved data 
associated with the request packet. 

23. (New) The computer-implemented method as recited in claim 22, wherein the key 
includes information at a remote procedure call layer. 

24. (New) The computer-implemented method as recited in claim 23, wherein the 
information is included in an XID field. 
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25. (New) The computer-implemented method as recited in claim 22, wherein storing data 
associated with the request packet comprises storing the data in a hash table using the key as an 
index into the hash table. 

26. (New) The computer-implemented method as recited in claim 22, wherein the packet is 
read from a capture file. 

27. (New) The computer-implemented method as recited in claim 22, wherein the packet is 
collected in real time. 
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